Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific, suspicious command-line arguments (e.g., --no-first-run, --disable-gpu, about:blank) from parent processes that are not standard browser or update launchers. This behavior is indicative of Vidar Stealer attempting to force a browser instance to generate or expose the master encryption key, facilitating the theft of browser-stored credentials.
Detects unauthorized access to Chromium-based and Firefox browser credential stores (Login Data, Cookies, logins.json) by processes executing from temporary directories (e.g., AppData, Temp). This behavior is characteristic of infostealer malware, such as CASTLESTEALER, often delivered via process injection or hollowed processes.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Detects the execution of the legacy ntvdm.exe with a hex parameter, utilized for process injection and legacy compatibility layers.
Detects suspicious injection into a headless Chrome or Edge process by looking for the '--headless' and 'DEBUG_ONLY_THIS_PROCESS' command-line arguments. This combination suggests an attempt to bypass app-bound encryption, potentially via IElevator COM.
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
Detects the loading of the QoS WMI provider DLL (qoswmi.dll) into the WMI provider host (wmiprvse.exe). This behavior is associated with the EDRChoker technique, which can be used for stealthy execution and EDR evasion.
Detects execution of a SimpleRunPE-style loader from Downloads, Temp, AppData, or Public paths.
Detects the Print Spooler service (spoolsv.exe) spawning svchost.exe. This behavior is leveraged by the WIN_PLUS variant of SprySOCKS to execute a first-stage print processor loader, which then injects the backdoor into a newly created svchost.exe process.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
Page 41 of 55